CVE-2026-17409

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a case-sensitivity flaw (CWE-178) that allows unauthenticated attackers to bypass access controls by sending requests with altered casing, enabling unauthorized administrative operations and potential exposure of sensitive data.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication or user interaction required; only knowledge of the affected endpoints and ability to craft case-altered HTTP requests is needed.

Blast radius

Successful exploitation could allow full compromise of administrative functions and leakage of sensitive configuration or operational data across all tenants sharing the API Connect instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.